CVE - CVE-2023-46724

CVE-ID
CVE-2023-46724	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20231208-0001/ FEDORA:FEDORA-2023-6317eaa767 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEV66D3PAAY6K7TWDT3WZBLCPLASFJDC/ FEDORA:FEDORA-2023-ab77331a34 URL:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5QASTMCUSUEW3UOMKHZJB3FTONWSRXS/ MISC:http://www.squid-cache.org/Versions/v5/SQUID-2023_4.patch URL:http://www.squid-cache.org/Versions/v5/SQUID-2023_4.patch MISC:http://www.squid-cache.org/Versions/v6/SQUID-2023_4.patch URL:http://www.squid-cache.org/Versions/v6/SQUID-2023_4.patch MISC:https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810 URL:https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810 MISC:https://github.com/squid-cache/squid/security/advisories/GHSA-73m6-jm96-c6r3 URL:https://github.com/squid-cache/squid/security/advisories/GHSA-73m6-jm96-c6r3
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20231025	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20231025)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)